Answer by warren for Splunk Regex formatting

This regular expression is simpler, and should match for you:

<spl>
| rex field=_raw "status\W+(?<status>\w+)"
| search status="error"
<rest of spl

It matches the literal string status followed by non-word characters, then puts all found word characters into a field named status

from User warren – Stack Overflow https://stackoverflow.com/questions/73910663/splunk-regex-formatting/73939954#73939954
via IFTTT